route: fix ICMP redirect validation
The commit f39925dbde
(ipv4: Cache learned redirect information in inetpeer.)
removed some ICMP packet validations which are required by
RFC 1122, section 3.2.2.2:
...
A Redirect message SHOULD be silently discarded if the new
gateway address it specifies is not on the same connected
(sub-) net through which the Redirect arrived [INTRO:2,
Appendix A], or if the source of the Redirect is not the
current first-hop gateway for the specified destination (see
Section 3.3.1).
Signed-off-by: Flavio Leitner <fbl@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
da92b194cc
commit
7cc9150ebe
|
@ -1309,7 +1309,12 @@ static void rt_del(unsigned hash, struct rtable *rt)
|
||||||
void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
|
void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
|
||||||
__be32 saddr, struct net_device *dev)
|
__be32 saddr, struct net_device *dev)
|
||||||
{
|
{
|
||||||
|
int s, i;
|
||||||
struct in_device *in_dev = __in_dev_get_rcu(dev);
|
struct in_device *in_dev = __in_dev_get_rcu(dev);
|
||||||
|
struct rtable *rt;
|
||||||
|
__be32 skeys[2] = { saddr, 0 };
|
||||||
|
int ikeys[2] = { dev->ifindex, 0 };
|
||||||
|
struct flowi4 fl4;
|
||||||
struct inet_peer *peer;
|
struct inet_peer *peer;
|
||||||
struct net *net;
|
struct net *net;
|
||||||
|
|
||||||
|
@ -1332,14 +1337,35 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
|
||||||
goto reject_redirect;
|
goto reject_redirect;
|
||||||
}
|
}
|
||||||
|
|
||||||
peer = inet_getpeer_v4(daddr, 1);
|
memset(&fl4, 0, sizeof(fl4));
|
||||||
|
fl4.daddr = daddr;
|
||||||
|
for (s = 0; s < 2; s++) {
|
||||||
|
for (i = 0; i < 2; i++) {
|
||||||
|
fl4.flowi4_oif = ikeys[i];
|
||||||
|
fl4.saddr = skeys[s];
|
||||||
|
rt = __ip_route_output_key(net, &fl4);
|
||||||
|
if (IS_ERR(rt))
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (rt->dst.error || rt->dst.dev != dev ||
|
||||||
|
rt->rt_gateway != old_gw) {
|
||||||
|
ip_rt_put(rt);
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!rt->peer)
|
||||||
|
rt_bind_peer(rt, rt->rt_dst, 1);
|
||||||
|
|
||||||
|
peer = rt->peer;
|
||||||
if (peer) {
|
if (peer) {
|
||||||
peer->redirect_learned.a4 = new_gw;
|
peer->redirect_learned.a4 = new_gw;
|
||||||
|
|
||||||
inet_putpeer(peer);
|
|
||||||
|
|
||||||
atomic_inc(&__rt_peer_genid);
|
atomic_inc(&__rt_peer_genid);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ip_rt_put(rt);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}
|
||||||
return;
|
return;
|
||||||
|
|
||||||
reject_redirect:
|
reject_redirect:
|
||||||
|
|
Loading…
Reference in a new issue